I want to write a condition where it will check count for each host and not total
So instead of this ctx.results[0].hits.total.value > 400
I need to access doc_count
something like the following: ctx.results[0].aggregations.group_by_host.buckets.doc_count > 400
Following is the response from extraction query which i am using for trigger action how can i access doc_count which i under buckets so it will only qualify
I’ve run into this issue and im still working it but I know that because the buckets are in an array like the results you have to include that array in your source like the [0] here referencing the first item in the array. What I am trying to figure out is how to match that against all buckets.
Am I understanding correctly that in your trigger condition you would like to loop over all values in ctx.results[0].aggregations.group_by_host.buckets? If so you can do this by using the .size() so something like:
for (int i = 0; i < ctx.results[0].aggregations.group_by_host.buckets.size(); i++) {
// bucket values can be accessed via: ctx.results[0].aggregations.group_by_host.buckets[i].doc_count
// for example.
}
i dont think that the real problem is solved here. problem is how to check if any buckets in the bucket list is triggers the condition. @lucaswin-amzn sadly your for loop does not work on Opendistro.
Creating a trigger based on the first bucket won’t be effective i think because i may have several buckets and maybe the last bucket exceeds the threshold.